Security Groups vs. NACLs Cheat Sheet

Cybr christophelimp christophe limpalair https://cybr.com

Comparison

Comparison	Security Groups (SGs)	Network Access Control Lists (NACLs)
Scope	Operate at the instance level	Operate at the subnet level (sort of like network-based firewalls)
Maintains state?	Yes - Stateful Automatically allows outbound traffic if it was allowed inbound and vice versa	No - Stateless Does not automatically allow outbound traffic if it was allowed inbound or vice versa
Rule evaluation	All security group rules are evaluated and access is permitted if any security group rule permits access	Evaluates rules in order from lowest number to highest until there’s a match (ie: Rule #100 evaluates before #110, and if it matches the request, rule #110 never gets evaluated)
How are they applied?	Multiple can be applied to a single host	Only one NACL can be applied per subnet, but the same NACL can be applied to multiple subnets
Permissions	Can only specify allow rules, not deny rules. Deny is the default. Can have both inbound and outbound rules, but neither is technically required	Can specify both allow and deny, and there’s a catch-all deny if nothing matches. Has inbound and outbound rules and both are required
Anatomy of rules	Name Rule ID IP version (IPv4, IPv6, or blank) Protocol Type (ie: HTTPS, All Traffic, etc) Protocol (ie: TCP) Port range Source or destination (can even reference security groups) Description (optional)	Rule number Type (ie: SSH) Protocol (ie: ICMP, TCP, etc) Port range (ie: 22, 1024 - 65536, etc) Source (inbound rules only) - Destination (outbound rules only) Allow/Deny
Examples	Allow requests with specific Protocols/Ports/IPs to reach or leave hosts. Should be very specific and as restrictive as possible.	Allow or Block requests Protocols/Ports/IPs to enter or leave specific subnets. Tends to be broader than SGs. * It’s important to note that NACLs only control traffic entering or leaving subnets, not intra-subnet traffic

Examples

Security Group Rules - Example access rules for web server instances

Inbound

Protocol type	Protocol number	Port	Source IP	Notes
TCP	6	80 (HTTP)	0.0.0.0/0	Allows inbound HTTP access from any IPv4 address
TCP	6	443 (HTTPS)	0.0.0.0/0	Allows inbound HTTPS access from any IPv4 address
TCP	6	80 (HTTP)	::/0	Allows inbound HTTP access from any IPv6 address
TCP	6	443 (HTTPS)	::/0	Allows inbound HTTPS access from any IPv6 address

Source: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html#sg-rules-web-server

NACL Rules - Example access rules for subnets hosting web servers

Inbound

Rule #	Type	Protocol	Port range	Source	Allow/Deny	Comments
100	HTTP	TCP	80	0.0.0.0/0	ALLOW	Allows inbound HTTP traffic from any IPv4 address.
110	HTTPS	TCP	443	0.0.0.0/0	ALLOW	Allows inbound HTTPS traffic from any IPv4 address.
120	SSH	TCP	22	192.0.2.0/24	ALLOW	Allows inbound SSH traffic from a specific public IPv4 address range
140	Custom TCP	TCP	32768-65535	0.0.0.0/0	ALLOW	Allows inbound return IPv4 traffic from the internet (that is, for requests that originate in the subnet).
*	All traffic	All	All	0.0.0.0/0	DENY	Catch-all deny rule (can’t be modified or removed)

Outbound

Rule #	Type	Protocol	Port range	Destination	Allow/Deny	Comments
100	HTTP	TCP	80	0.0.0.0/0	ALLOW	Allows outbound IPv4 HTTP traffic from the subnet to the internet.
110	HTTPS	TCP	443	0.0.0.0/0	ALLOW	Allows outbound IPv4 HTTPS traffic from the subnet to the internet.
120	SSH	TCP	1024-65535	192.0.2.0/24	ALLOW	Allows outbound SSH traffic from a specific public IPv4 address range
140	Custom TCP	TCP	32768-65535	0.0.0.0/0	ALLOW	Allows outbound IPv4 responses to clients on the internet
*	All traffic	All	All	0.0.0.0/0	DENY	Catch-all deny rule (can’t be modified or removed)

Source: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

Security Groups vs. NACLs

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

Use this Cybr cheat sheet as reference: Security Groups vs. NACLs
Source: https://cybr.com/cheat-sheets/nacl-vs-sgs/

My goal: Explain the differences

Teach me the differences between Security Groups and NACLs using a web request and its return traffic. Explain scope, statefulness, allow versus deny rules, rule evaluation, and ephemeral ports. Ask about my experience first, and check my understanding with a worked traffic example.

Use the included reference material even if you cannot open the source URL. Ask for missing context rather than inventing my environment. Explain assumptions. For version-sensitive service behavior or commands, consult current official documentation when available, cite it, and explain any differences from this reference. If you cannot verify something, say so.

Reference material from the cheat sheet (structured text or a curated summary):

{
  "title": "Security Groups vs. NACLs",
  "columns": [
    "Comparison",
    "Security Groups (SGs)",
    "Network Access Control Lists (NACLs)"
  ],
  "comparison": [
    {
      "label": "Scope",
      "sg": [
        "Operate at the instance level"
      ],
      "nacl": [
        "Operate at the subnet level (sort of like network-based firewalls)"
      ]
    },
    {
      "label": "Maintains state?",
      "sg": [
        "Yes - Stateful",
        "Automatically allows outbound traffic if it was allowed inbound and vice versa"
      ],
      "nacl": [
        "No - Stateless",
        "Does not automatically allow outbound traffic if it was allowed inbound or vice versa"
      ]
    },
    {
      "label": "Rule evaluation",
      "sg": [
        "All security group rules are evaluated and access is permitted if any security group rule permits access"
      ],
      "nacl": [
        "Evaluates rules in order from lowest number to highest until there’s a match (ie: Rule #100 evaluates before #110, and if it matches the request, rule #110 never gets evaluated)"
      ]
    },
    {
      "label": "How are they applied?",
      "sg": [
        "Multiple can be applied to a single host"
      ],
      "nacl": [
        "Only one NACL can be applied per subnet, but the same NACL can be applied to multiple subnets"
      ]
    },
    {
      "label": "Permissions",
      "sg": [
        "Can only specify allow rules, not deny rules. Deny is the default.",
        "Can have both inbound and outbound rules, but neither is technically required"
      ],
      "nacl": [
        "Can specify both allow and deny, and there’s a catch-all deny if nothing matches. Has inbound and outbound rules and both are required"
      ]
    },
    {
      "label": "Anatomy of rules",
      "sg": [
        "Name",
        "Rule ID",
        "IP version (IPv4, IPv6, or blank)",
        "Protocol Type (ie: HTTPS, All Traffic, etc)",
        "Protocol (ie: TCP)",
        "Port range",
        "Source or destination (can even reference security groups)",
        "Description (optional)"
      ],
      "nacl": [
        "Rule number",
        "Type (ie: SSH)",
        "Protocol (ie: ICMP, TCP, etc)",
        "Port range (ie: 22, 1024 - 65536, etc)",
        "Source (inbound rules only) - Destination (outbound rules only)",
        "Allow/Deny"
      ]
    },
    {
      "label": "Examples",
      "sg": [
        "Allow requests with specific Protocols/Ports/IPs to reach or leave hosts. Should be very specific and as restrictive as possible."
      ],
      "nacl": [
        "Allow or Block requests Protocols/Ports/IPs to enter or leave specific subnets. Tends to be broader than SGs.",
        "* It’s important to note that NACLs only control traffic entering or leaving subnets, not intra-subnet traffic"
      ]
    }
  ],
  "sgTitle": "Security Group Rules - Example access rules for web server instances",
  "sgHeaders": [
    "Protocol type",
    "Protocol number",
    "Port",
    "Source IP",
    "Notes"
  ],
  "sgRules": [
    [
      "TCP",
      "6",
      "80 (HTTP)",
      "0.0.0.0/0",
      "Allows inbound HTTP access from any IPv4 address"
    ],
    [
      "TCP",
      "6",
      "443 (HTTPS)",
      "0.0.0.0/0",
      "Allows inbound HTTPS access from any IPv4 address"
    ],
    [
      "TCP",
      "6",
      "80 (HTTP)",
      "::/0",
      "Allows inbound HTTP access from any IPv6 address"
    ],
    [
      "TCP",
      "6",
      "443 (HTTPS)",
      "::/0",
      "Allows inbound HTTPS access from any IPv6 address"
    ]
  ],
  "sgSource": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html#sg-rules-web-server",
  "naclTitle": "NACL Rules - Example access rules for subnets hosting web servers",
  "naclInboundHeaders": [
    "Rule #",
    "Type",
    "Protocol",
    "Port range",
    "Source",
    "Allow/Deny",
    "Comments"
  ],
  "naclOutboundHeaders": [
    "Rule #",
    "Type",
    "Protocol",
    "Port range",
    "Destination",
    "Allow/Deny",
    "Comments"
  ],
  "naclInbound": [
    [
      "100",
      "HTTP",
      "TCP",
      "80",
      "0.0.0.0/0",
      "ALLOW",
      "Allows inbound HTTP traffic from any IPv4 address."
    ],
    [
      "110",
      "HTTPS",
      "TCP",
      "443",
      "0.0.0.0/0",
      "ALLOW",
      "Allows inbound HTTPS traffic from any IPv4 address."
    ],
    [
      "120",
      "SSH",
      "TCP",
      "22",
      "192.0.2.0/24",
      "ALLOW",
      "Allows inbound SSH traffic from a specific public IPv4 address range"
    ],
    [
      "140",
      "Custom TCP",
      "TCP",
      "32768-65535",
      "0.0.0.0/0",
      "ALLOW",
      "Allows inbound return IPv4 traffic from the internet (that is, for requests that originate in the subnet)."
    ],
    [
      "*",
      "All traffic",
      "All",
      "All",
      "0.0.0.0/0",
      "DENY",
      "Catch-all deny rule (can’t be modified or removed)"
    ]
  ],
  "naclOutbound": [
    [
      "100",
      "HTTP",
      "TCP",
      "80",
      "0.0.0.0/0",
      "ALLOW",
      "Allows outbound IPv4 HTTP traffic from the subnet to the internet."
    ],
    [
      "110",
      "HTTPS",
      "TCP",
      "443",
      "0.0.0.0/0",
      "ALLOW",
      "Allows outbound IPv4 HTTPS traffic from the subnet to the internet."
    ],
    [
      "120",
      "SSH",
      "TCP",
      "1024-65535",
      "192.0.2.0/24",
      "ALLOW",
      "Allows outbound SSH traffic from a specific public IPv4 address range"
    ],
    [
      "140",
      "Custom TCP",
      "TCP",
      "32768-65535",
      "0.0.0.0/0",
      "ALLOW",
      "Allows outbound IPv4 responses to clients on the internet"
    ],
    [
      "*",
      "All traffic",
      "All",
      "All",
      "0.0.0.0/0",
      "DENY",
      "Catch-all deny rule (can’t be modified or removed)"
    ]
  ],
  "naclSource": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html"
}